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REMARKS/ARGUMENTS 

Claims 1-6 and 8-21 are currently pending. Applicants have amended claims 1 

and 19-21, and have canceled claim 1 1 and 1 5. Applicants submit that no new matter has been 
added to the application as a result of these amendments. 

Claims 1-6 and 8-21 stand rejected under 35 U.S.C. §103(a) as being unpatentable 
over U.S. Patent No. 5,882,5 1 7 to Dotan (hereinafter "Dotan") in view of U.S. Patent No. 
5,123,045 to Ostrovsky, et al. (hereinafter "Ostrovsky"). 

Reconsideration in view of the foregoing amendments and the following remarks 
is respectfully requested. • 

Rejections under 35 U.S.C. 8103(a) 

Claims 1-6 and 8-21 stand rejected under 35 U.S.C. § 103(a) as being unpatentable 
over Dotan in view of Ostrovsky. 

Solely in order to expedite prosecution, Applicants have amended independent 
claims 1 and 19-21 to include features formerly recited in claims 1 1 and 15, and Applicants 
submit that even if Dotan and Ostrovsky could be combined as suggested in the Office Action, 
the combination fails' to disclose or suggest all of the features recited in claims 1 and 19-21. For 
example, claim 1 recites, in part, that "the at least one remedial measure comprises determining a 
storage location associated with suspected executable code in the computer system and moving 
suspected executable code to a specified storage location for later evaluation." Applicants 
submit that neither Dotan nor Ostrovsky teach this feature of claim 1 . 

The Examiner relied upon col. 4, lines 57-64 to teach this feature of claim 1. 
However, the cited portion of Dotan merely describes generating an alarm signal if the final state 
of a program does not match the initial state of the program, and that after the alarm is generated 
a backup and restore technique may be invoked to restore the infected program to it initial state. 
See Dotan, col. 4, lines 57-64. The cited portion of Dotan does not disclose determining a 
storage location associated with a suspected executable code as recited in claim 1 . In Dotan, the 
method for detecting an infection in a program is invoked each time that an executable program 
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is launched by a user or by another program. The user or the other program select the executable 
program to be launched, and the program is read from the computer's hard drive into memory. 
There is no consideration of determining a storage location associated with suspected executable 
code as recited in claim 1 , because the program information is already loaded into memory prior 
to invoking the method disclosed in Dotan. Furthermore, Dotan merely describes restoring the 
state of a program to its initial state. Dotan neither teaches nor suggests quarantining suspected 
executable code in a specified storage location so that the suspected executable code can be later 
evaluated. See Specification at [0038]. 

For at least the reasons provided, the combination of Dotan and Ostrovsky fails to 
disclose or suggest all of the features recited in claim 1. Claims 19-21 should be allowable for 
similar reasons as claim 1 . Furthermore, dependent claims 2-6, 8-10, and 12-18 should also be in 
condition for allowance at least due to their dependence from claim 1 . 

Accordingly, withdrawal of the rejection of claims 1-6, 8-10, and 12-18 under 35 
U.S.C. §103(a) is respectfully requested. 
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CONCLUSION 

In view of the foregoing, Applicants believe all claims now pending in this 



Application are in condition for allowance and an action to that end is respectfully requested. 



If the Examiner believes a telephone conference would expedite prosecution of 



this application, please telephone the undersigned at 858-350-6100. 



TOWNSEND and TOWNSEND and CREW LLP 

Two Embarcadero Center, Eighth Floor 

San Francisco, California 941 1 1-3834 

Tel: 858-350-6100 

Fax:415-576-0300 

Attachments 

JSK:s6c 

61689714 vl 




Jeffrey S. King 
Reg. No. 58,791 



Page 9 of 9 



